Virtual Card Login Credential for OTP-Resistant Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional multi-factor authentication (MFA) systems, particularly two-factor authentication (2FA) systems, are vulnerable to compromise due to interception of one-time pins (OTPs), lacking robust security in certain environments.
Innovation Solution
Implement a user authentication system that utilizes a virtual card number (VCN) as a login credential, processed through a credit card payment network with zero charge authorization, integrating machine learning for fraud detection and customizable usage patterns, and combining with biometric data for enhanced security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional 2FA systems use OTP for authentication, then authentication capability is provided, but security is compromised when OTP is intercepted
Solution Approach 1:
The patent extracts the authentication credential from the traditional OTP message and embeds it within a virtual card number structure. The VCN is generated through a secure tokenization process that separates the authentication element from the communication channel, making interception ineffective. The VCN is derived from encrypting a secret value with the domain name, creating a bound credential that cannot be reused or transferred.
Solution Approach 2:
The patent transforms the authentication parameter from a temporary OTP code to a structured virtual card number with multiple components (encrypted secret, domain hash, timestamp, counter). This parameter transformation enables the authentication credential to be bound to specific domain and time, preventing interception and reuse attacks while maintaining the temporary nature required for security.
2Reliability
If virtual card number with zero charge amount is used for authentication, then security is enhanced through payment network verification, but system complexity increases
Solution Approach 1:
The patent makes the virtual card number system multi-functional by designing it to work with existing payment network infrastructure for authentication purposes. The VCN can be processed through standard payment authorization channels, leveraging the existing robust security and verification mechanisms of payment networks without requiring a completely new authentication infrastructure.
Solution Approach 2:
The patent introduces a tokenization service as an intermediary that generates and manages virtual card numbers. This intermediary layer handles the complex cryptographic operations and coordinates with both the payment network and the target service, shielding the end user from complexity while enabling secure authentication through the payment network's established protocols.
3Reliability
If virtual card number is customized for one-time use or specific merchant, then fraud detection capability is improved, but device complexity increases
Solution Approach 1:
The patent applies preliminary action by pre-configuring the virtual card number with usage restrictions, including one-time use flags and merchant-specific bindings, before the authentication event occurs. The VCN is generated with embedded parameters that define its scope of validity, enabling automatic fraud prevention without requiring real-time analysis or complex decision-making during the authentication process.
Data Source
AI summary
Disclosed embodiments pertain to systems and methods related to user authentication with a virtual payment card. A virtual card number can be requested as a login credential for a user. A virtual card number can be transmitted through a credit card payment network to a financial institution that issued the virtual card for payment authorization. The user can subsequently be authenticated in response to a granted payment authorization by the financial institution. The financial institution can execute a machine learning model trained to infer fraud based on a usage pattern associated with a virtual card number. Granting or denying payment authorization can depend on a confidence score returned by the model regarding the likelihood of fraud. A virtual card number associated with authentication can include one or more distinguishing characteristics in one instance. Further, virtual card numbers can include use restrictions in time and location.